Security Notices
Home Assistant Security Update Addresses 2 Vulnerabilities
Home Assistant fixes separate IPP-discovery SSRF and Statistics Graph tooltip script injection. Select a supported release containing both Core and frontend fixes, restrict untrusted discovery traffic, and retain configuration backups before updating.
Traefik Security Update Addresses 1 Vulnerability
Traefik BasicAuth timing can reveal whether usernames exist in affected 3.6 and 3.7 releases. Upgrade through a supported path containing 3.7.13; the flaw does not disclose passwords or bypass authentication.
Gardener Security Update Addresses 1 Vulnerability
Gardener project administrators can bypass membership permission checks when changing groups, potentially exposing project secrets. Apply the branch-specific fix and review existing grants; patching alone does not revoke unauthorized memberships or exposed credentials.
Cloudreve Security Update Addresses 3 Vulnerabilities
Cloudreve 4.18.0 addresses upload quota races, read-only admin-token overreach and conditional remote-download SSRF. Update servers, review permissions and monitor storage headroom; the SSRF report does not prove credential theft from a real cloud deployment.
Spree Security Update Addresses 1 Vulnerability
Spree's Store API v3 can let authenticated customers claim another shopper's guest cart and expose stored checkout addresses under the stated conditions. Update the backend branch; replacing the storefront alone does not fix authorization.
OpenPLC Runtime v4 Replaces Vulnerable End-of-Life v3
End-of-life OpenPLC Runtime v3 has a web-interface script-injection flaw that can affect operator sessions. Limit exposure and plan an operations-approved v4 migration, validating programs, I/O and safe-state recovery offline before cutover.
LightRAG Security Update Addresses 5 Vulnerabilities
LightRAG 1.5.5 addresses API disclosure, plaintext-password timing, login throttling, Markdown-image SSRF and stored WebUI script injection. Update backend and frontend components, then check the actual authentication, ingestion and rate-limit configuration.
Nautobot Security Update Addresses 2 Vulnerabilities
Nautobot fixes stored script injection in form help text and a separate approval-workflow authorization bypass. Match the installed branch, review content-editing and approval permissions, and validate both browser rendering and scheduled-job approval boundaries.
Autobahn Python Security Update Addresses 1 Vulnerability
Autobahn Python and Crossbar can accept expanded WebSocket messages exceeding configured limits when compression is enabled. Update affected dependencies to 26.7.1, redeploy consumers, and validate decompressed-message limits; the demonstrated impact is availability.
Nuclei Security Update Addresses 5 Vulnerabilities
Nuclei 3.10.0 fixes scanner-host code, file-access and conditional environment-disclosure flaws. Update engines and SDK consumers, stop untrusted template execution, and handle potentially exposed credentials separately from the upgrade.